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Resum 



L'estudi de I'eficiencia en els protocols de Criptografia es una tasca clau per a la seva 
futura implementacio tecnologica ja que els recursos fi'sics dels quals es disposa exper- 
imentalment no son il-limitats. En aquesta tesina s'estudia I'eficiencia en els protocols 
de distribucio de claus quantiques basats en rentrellagament quantic. Usant estats 
de variable discreta i destil-lant entrellacament, sempre es possible destil-lar singlets 
i aixi extreure correlacions classiques perfectes. En canvi, niitjangant estats de vari- 
able contmua com ho son els modes de la Hum, la destil-lacio no es possible mitjangant 
nomes operacions Gaussianes. No obstant, mostrem que, utilitzant estats Gaussians 
de Hum bipartits i I'entrellagament en les quadratures del camp electromagnetic 
d'aquests estats, si es possible extreure seqiiencies de bits correlacionats, necessaries 
per destil-lar claus aleatories segures de forma eficient. Obtenim que, usant estats 
mescla Gaussians NPPT simetrics i operacions Gaussianes es poden distribuir claus 
quantiques segures davant d'atacs individuals d'un espia. Davant d'atacs finits co- 
herents no tots els estats permeten una extraccio segura. Mostrem quins estats si 
son segurs davant d'atacs finits coherents i I'eficiencia amb la qual es poden extreure 
aquestes correlacions classiques davant d'atacs individuals. Finalment s'analitza la 
relacio entre I'eficiencia, I'entrellagament i la puresa per estats Gaussians simetrics. 
Concloem que un entrellagament gran (mes correlacions entre els modes) implica un 
guany en eficiencia a I'hora d'extreure bits ben correlacionats. No hi ha una relacio 
un a un donat que estats amb el mateix entrellagament pero diferents pureses donen 
Hoc a diferent eficiencia. El que succeeix es que estats amb una puresa alta afavor- 
eixen un augment en I'eficiencia donat que estem desentrellagant I'espia, pero aquests 
estats son ineficients quan finalment realitzem Classical Advantatge Distillation on, 
per extreure la clau aleatoria segura un alt grau de correlacions es essencial. 
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Chapter 1 

Introduction 



Rolf Landauer, known for his remarkable contributions to the theory of electrical 
conductivity, mesoscopic phenomena, and the physics of information, during the 
1960s, as the director of IBM Research's Solid State Science Division persuaded the 
idea that information was rather than an abstract concept a physical one. 

Nowadays the Quantum Information science (QI) has become one of the most 
active fields of research. QI research spreads in two main areas. Quantum Com- 
munication and Quantum Computation tasks. One of the most important topics 
of Quantum Communication deals with the study of secure communications. Thus 
Cryptography, based in protocols that exploit Quantum Mechanics properties, plays 
a central role in Quantum Communication. 

Cryptography refers to strategies which permit the secure communication be- 
tween two distant parties (traditionally denoted by Alice and Bob) that wish to 
communicate secretly. So its purpose is to design new communication algorithms 
being sure that secrecy is preserved. In Classical Cryptography there is only one 
cryptographic protocol, known as the ideal Vernam cypher method, which is ab- 
solutely secure. The Vernam cypher consists of a random secret key (private key) 
shared between Alice (the sender) and Bob (the receiver) used to encode and decode 
messages. However, this method suffers from two drawbacks. First, if Alice wants to 
communicate A^ bits to Bob, they will need to have a random secret key in advance 
with at least A^ bits. Moreover, this key can only be used once to make the method 
unbreakable. Second, the key must originally be exchanged by hand before the com- 
munication to keep secrecy and it is essential that the key is totally random. To 
solve the second issue, classical ways exist to distribute the key among them being 
this distribution partially secure. This problem is known as Key Distribution. 

In Classical Cryptography the problem of Key Distribution can be solved partially 
by designing new algorithms which permit the distribution of the secret key in a 
"practical secure" way. The price to pay is that absolute security is not achievable. 
Nevertheless as security relies on the fact that to decrypt one needs to invert difficult 
mathematical operations, the time to decrypt the key is long, and thus practical 
security is achievable. 
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The distribution problem is classically solved by using Public Key Cryptosystems. 
They work as follows: Alice and Bob possess, in advance, a common secret key. This 
secret key can be used many times to distribute among them, several private keys 
that they are going to use to encrypt messages through e.g. the Vernam cypher 
method. Any time Alice (the sender) wants to distribute a private key to encrypt 
later messages, she only needs to make one key publicly available, referred as the 
public key. From this public key any receiver can extract the private key, but only 
Bob (the receiver in possesion of the secret key) can extract it in an efficient way. 
Any receiver without the secret key needs to decrypt a problem which has non- 
polynomial (NP) complexity. This way of distributing a secure key can be done even 
when the key's length is much smaller than the message and even if the key is used 
several times. 

Nowadays bank's security, electronic commerce and the internet are mostly based 
on one of these algorithms, the RSA Cryptography algorithm proposed in 1977 by 
ffivest, 5hamir, and Adleman from the MIT. Security in RSA algorithm relies on 
the fact that to decrypt the algorithm one needs to solve the factorisation problem 
which is an NP problem. Even now, there is no efficient algorithm known to solve 
the factorisation problem. This means that even though computational resources 
increase constantly, one simply needs to exploit the NP character of the algorithm to 
make the solution harder to find. Moreover, the key can eventually be redistributed 
and changed. 

The "Quantum Computer" arises here first as a menace for Classical Key Distri- 
bution methods and then as a the solution for the security in Cryptography. Based 
on the Quantum nature of the microscopic world, this new generation of computers, 
still in a theoretical stage, are known to be able to solve hard mathematical problems 
rapidly. In 1994 Peter Shor proposed a Quantum protocol to solve the factorisation 
problem in an efficient way, known as the Shor's algorithm. If such a computer can 
be realised, current cryptographic protocols will not be anymore secure. 

Can Quantum Mechanics then offer a solution for a secure Cryptography method? 
The answer is yes. Based on the intrinsic nature of the microscopic world. Quantum 
Mechanics permits to perform Cryptography in an unconditional secure way. At 
present. Quantum Cryptography is the only real implementation of QI. In this work, 
we will present one way of performing efficient Quantum Cryptography using entan- 
gled Gaussian states of light and standard optical devices (Gaussian operations). 

1.1 Classical Cryptography 

1.1.1 Vernam cypher 

In Classical Cryptography there is a protocol called Vernam cypher which is abso- 
lutely secure. This protocol is the best and most well known classical private key 
(or ONE-TIME-PAD) cryptosystem. In order to achieve security in communications 
between two parties (Alice and Bob) with the Vernam cypher protocol, one needs to 
have a private key, in advance, possessed by Alice and Bob exclusively of at least the 
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same length [^ of bits) as the message to be encoded. This key has to be random 
and in possession of Alice and Bob only, and so a Classical Key Distribution is a 
pre-condition to achieve this absolute security. If this is the case, then Cryptography 
is going to be absolutely secure and works as follows. 

If Alice wants to encode a message m with the key fc, she only needs to perform 
the following operation between the message and the key, and send the encoded 
message e to Bob: 

Encfc(m) = m®k = e. (1-1) 

Only Bob who has also the key can decode the message (invert the operation) because 
the key Alice has used is random. Thus, he only needs to use the key again and 
perform the following operation to the encoded message e to retrieve the original 
message m: 

Decfc(e) = Decfc[Encfc(m)] =e(Bk = d = m. (1.2) 

Let us illustrate Vernam cypher with an specific example. Alice wants to communi- 
cate to Bob, in a secure way, a message m (in a binary string) of e.g. 9 bits. They 
share the key k of the same size as the message (9 bits). Alice encodes her message 
by applying a XOR (exclusive OR) \j operation between the message m and the key 
k. 

In the following table we summarise the XOR operation 



e 





1 








1 


1 


1 






:i.3) 



As a result Alice has the encoded message e, that will send to Bob in a public 
way. 



message 


m = 010011101 


key 


k = 110100011 


encoded message 


e = 1000111110 



Then Bob wants to readout the message, and thus, performs the inverse opera- 
tion (which is again a XOR) between the encoded message e and the key k. 

As a result Bob has the decoded message d that coincides with the message Alice 
wanted to communicate to him. 



encoded message 


e = 1000111110 


key 


k = 110100011 


decoded message 


d = 010011101 



^Also known as AND or © mod (2). 
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1.1.2 Public key distribution: The RSA algorithm 

Thus far, Classical Cryptography has not solved the distribution of the private key 
needed to perform Vernam cypher encryption. This distribution can be done in 
a public and practical secure way with the RSA algorithm. Nowadays the RSA 
algorithm is the most commonly used algorithm of public key. It is a Classical Key 
Distribution algorithm that permits together with the Vernam cypher method to 
perform secure communication as long as the factorisation problem is unsolved. Let 
us illustrate how it works with the following example. 

i) The sender, say Alice, chooses two "big" different prime numbers, say p = 61 
and q = 53 and computes its product n = pq = 3233 and also the following quantity 
(j)={p- l)(g-l) = 3120. 

ii) She chooses a positive integer / smaller and coprime with (p, in the example 
/ = 17. 

in) As a private key, Alice gives to Bob the number k such that kl = 1 mod (0), 
take e.g. k = 2753. At the same time Alice makes public / and n, what we call 
public key. 

iv) With the public key {I and n) anyone can encrypt a message m and send it 
to Bob, but only Bob who is in possesion of the private key k is able to decrypt the 
message. This method can thus be used to perform Classical Key Distribution. Any 
time Alice wants to communicate with Bob, she sends a secure key encrypted with 
/ and n and only Bob will be able to retrieve it. Once Bob has the secure key, Alice 
can send messages to Bob via the Vernam cypher using this secure key. 

v) Encryption proceeds as follows. Alice wants to distribute a key encoded in a 
message m = 123. She uses the public key and computes the encryption Enc;^„(r?i) = 
TO,' mod (n) = e = 855. 

vi) Bob now wants to decrypt the message e to extract a secure key, so he 
calculates Dec,fc^„(e) = DeCfe^„[Encj^„(m)] = e'' mod (n) = d = m = 123. Bob is the 
only one in possesion of the private key k and so the only one that can decrypt the 
message e to find the secure key Alice is going to use with the Vernam cypher to 
communicate securely with him. 

The private key Alice and Bob share can be used more than once to distribute 
secure keys, in such a way that, to perform Vernam cypher we no longer need to 
share a long private key because we can distribute many of them in a secure way. 
Security relies in the fact that, from the encrypted message e, and the public keys 
I and n it is very difficult to find the private key k (and so m) or the original two 
prime numbers q and p, even in the case we are reusing the key k. This is because 
factorisation is a NP problem, whose efficient solution is not known yet. Security 
thus, in the RSA algorithm, relies on the fact that with the current computation 
resources, NP problems cannot be solved efficiently. 
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1.2 The solution to the distribution of the key 

What Quantum Cryptography offers is an absolutely secure distribution of a ran- 
dom key which combined with the Vernam cypher guarantees completely secure 
Cryptography. Thus, the Quantum Cryptography problem is in fact the problem 
of distributing a secure random key, i.e. the Quantum Key Distribution (QKD) 
problem. 

Quantum Cryptography relies on the possibility of establishing a secret random 
key between two distant parties traditionally denoted by Alice and Bob. If the key is 
securely distributed, the algorithms used to encode and decode any message can be 
made public without compromising security. The key consists typically in a random 
sequence of bits which both, Alice and Bob, share as a string of classically correlated 
data. The superiority of Quantum Cryptography comes from the fact that the laws 
of Quantum Mechanics permit to the legitimate users (Alice and Bob) to infer if an 
eavesdropper has monitored the distribution of the key and has gained information 
about it. If this is the case, Alice and Bob will both agree in withdrawing the key 
and will start the distribution of a new one. In contrast, Classical Key Distribution, 
no matter how difficult the distribution from a technological point of view is, can 
always be intercepted by an eavesdropper without Alice and Bob realising it. 

In Quantum Cryptography two seemingly independent main schemes exist for 
QKD. The first, the "Prepare and Measure" scheme, originally proposed by C.H. 
Bennett and G. Brassard in 1988 and known as BB84 [T], does not use entangled 
states shared between Alice and Bob and the key is established by sending non- 
entangled quantum states between the parties and communicating classically. Secu- 
rity is guaranteed by the Quantum nature of the measurements. The second scheme 
("Entanglement based"), uses as a resource shared entanglement, like the one origi- 
nally proposed by A. Ekert in 1991 known as Ekert91 [2j, where indeed entanglement 
is explicitly distributed and the security is guaranteed by Bell's theorem. However, 
the two schemes have been shown to be completely equivalent [3], and specifically 
entanglement stands as a precondition for any secure key distribution [3]. 



1.2.1 "Prepare and Measure" scheme 

BB84 permits a secure distribution of a secret key. The protocol does not avoid an 
eavesdropper from intercepting the key, but it lets Alice and Bob know if the key has 
been intercepted, and so that it can be discarded. Security relies in the Quantum 
nature of the measurement. We sketch here the steps of the protocol. 

i) Alice prepares a secret sequence of random bits and encodes them in the state 
of a spin-1/2 system (or the polarisation of photons) by choosing randomly between 
two bases (Z and X). Alice encodes |ib) (|±)i,.) according to 0/1 in base Z (0/1 in 
base X). Then she sends Bob the states she has prepared. As an example: 
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Alice random bits 





1 


1 








1 


1 








Alice random bases 


Z 


X 


X 


X 


z 


X 


z 


X 


X 


Alice final states 


1+) 


1-). 


l-)x 


l+>x 


1+) 


I-). 


I-) 


\+). 


l+)x 



ii) Bob receives the states and measures in another random choice of bases. The 
outcome of the measurements is going to be retained as the bits received. 



Alice final states 


1+) 


l-)x 


I-). 


l+)x 


1+) 


l-)x 


I-) 


I+). 


l+)x 


Bob random bases 


X 


z 


X 


X 


X 


X 


X 


X 


X 


Bob final states 


l+)x 


1+) 


l->. 


l+)x 


l+)x 


l->x 


-). 


l+>x 


l+>x 


Bob received bits 








1 








1 


1 









in) Bob communicates to Alice his choice of basis in a public way. 

iv) Alice identifies the set of bits for which they have performed the measurement 
in the same basis, i.e. outcomes 3, 4, 6, 8 and 9. Alice and Bob discard the set of 
data in which they did not agree (the rest). 

v) Bob sends part of his data (received bits) to Alice by a public channel. Alice 
checks the correlation between the data. 

vi) If the error rate is less than 25% Alice deduces that there is not an eavesdrop- 
per present and she communicates it to Bob. Alice and Bob use the set of remaining 
data as a private key to encrypt messages with Vernam cypher. 

1.2.2 "Entanglement based" scheme 

Other protocols exist, which demand as a fundamental resource, shared entanglement 
between Alice and Bob. In the same way as in BB84, these protocols permit a secure 
distribution of a secret key. This can be done as far as the protocol ensures if there 
has been an interception of the key. Security relies in the Quantum correlations i.e. 
entanglement like in EkertQl. We sketch here the steps of this well-known protocol 
below. 

i) The first step consists on distributing (along the z direction) singlet states of 
a spin-1/2 system (or polarisations of photons) between Alice and Bob. Thus Alice 
and Bob share many copies of a Bell state |^~) = -7^(|0)|1) — |1)|0)). 

ii) Alice and Bob are going to measure in the x — y plane in one of the three 
directions given by unit vectors Ai = (cos(/>^,sini^<^) and Bj = (coscj)^ , sin cf)?) 
respectively, where the azimuthal angles are fixed to (pf = (0, vr/4, vr/2)* and to (pf = 
(7r/4, tt/2, 3iT/4y . Each time they will choose the basis randomly and independently 
for each pair of incoming particles. 

Hi) The quantity 

£{A,B,) = V++{A„Bj)+V^^{A,B,)-V+^{A,,B,)-V-+{A,Bj) (1.4) 

is the correlation coefficient of the measurements performed by Alice and Bob along 
Ai and by Bob along Bj. Here V±±{Ai,Bj) denotes the probability that result ±1 
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has been obtained along Ai and ±1 along Bj. Straightforward calculations give rise 
to 



V++{A,B,) = 


isin2(0f- 


-4>f), 


r^,{Ai,Bj) = 


isin2(0f- 


-<l>f), 


V+-{A,B,) = 


icos2(<^^ 


-<t^^l 


r^+{Ai,Bj) = 


icos^((/)f - 


-0f), 



thus according to the Quantum rules £{Ai,Bj) = —AiBj = cos(0^ — 4>^). We 
see that whenever they choose the same orientation Quantum Mechanics predicts 
total anticorrelation in the outcomes i.e. £{Ai,Bj) = —1. 

iv) Here we define a quantity composed of those correlation coefficients for which 
Alice and Bob have measured in different directions, 

S = \£iAuBi) + £{A3,Bs)-£{Ai,B3)+£iA3,Bi)\. (1.5) 

Again, Quantum Mechanics requires, S = 2\pl > 2. 

v) After the transmission has taken place, Alice and Bob can announce in public 
the orientations they have chosen for each measurements and divide them into two 
separated groups. A first group for which they coincide and a second group for which 
they do not. The second group of outcomes is made public and it is used to establish 
the value of S. 

The CHSH (Clauser, Home, Shimony, and Hold) inequalities, a generalisation 
of Bell inequalities, asserts that 5 < 2. But Quantum Mechanics, and in particular 
Bell states, violate CHSH inequalities. If this is the case, i.e. the value of S that 
they find is exactly 2\/2, they now that their states have not been disturbed and so 
the first group of outcomes, that are random, are totally anticorrelated and can be 
converted into a secret string of bits. Later on they can use this string as a private 
key to encrypt messages with Vernam cypher. 

1.3 Efficiency in Quantum Key Distribution (QKD) pro- 
tocols 

As already mentioned. Quantum Key Distribution, refers to specific Quantum strate- 
gies which permit the secure distribution of a secret key between two parties that wish 
to communicate secretly. Quantum Cryptography has been proved unconditionally 
secure in ideal scenarios and has been successfully implemented using quantum states 
with finite (discrete) as well as infinite (continuous) degrees of freedom. We have 
analysed the efficiency of QKD protocols that use as a resource entangled Gaussian 
states and Gaussian operations only. In this framework, it has already been shown 
that QKD is possible ^ but the issue of its efficiency was not considered. We have 
propose a figure of merit (the efficiency £") to quantify the number of classical cor- 
related bits that can be used to distill a key from a sample of A^ entangled states. 
We have related the efficiency of the protocol to the entanglement and purity of the 
states shared between the parties. 
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Notice that if Alice and Bob share a collection of distillable entangled states, 
they can always obtain a smaller number of maximally entangled states from which 
they can establish a secure key f6]. The number of singlets (maximally entangled 
states) that can be extracted from a quantum state using only Local Operations and 
Classical Communication (LOCC) is referred to as the Entanglement of Distillation 
Ed. In order to establish a key, another important concept is the number of secret 
bits Ku, that can be extracted from a quantum state using LOCC. As a secret bit 
can always be extracted from maximally entangled state, E^ < Kq. Furthermore, 
there are quantum states which cannot be distilled but in spite of being entangled, 
i.e., have E^ = 0. They are usually referred to as bound entangled states since its 
entanglement is bound to the state. Nevertheless, for some of those states it has 
been shown that Kd ^ and thus they can be used to establish a secret key |7j. 

A particular case of states that cannot be "distilled" by "normal" procedures are 
continuous variables Gaussian states, e.5., coherent, squeezed and thermal states of 
light. By "normal" procedures we mean operations that preserve the Gaussian char- 
acter of the state (Gaussian operations). They correspond e.g. to beam splitters, 
phase shifts, mirrors, squeezers, etc. Thus, in the Gaussian scenario all entangled 
Gaussian states posses bound entanglement. Quantum Cryptography with Gaussian 
states using Gaussian operations has been experimentally implemented using "Pre- 
pare and Measure" schemes with either squeezed or coherent states [H |9l [10] . Those 
schemes do not demand entanglement between the parties. 

Navascues et al. [5] have shown that it is also possible using only Gaussian 
operations to extract a secret key a la Ekert91 from entangled Gaussian states, in 
spite the fact that these states are not distillable. In other words, it has been proven 
that in the Gaussian scenario all entangled Gaussian states fulfil GKo > (where 
the letter G stands for Gaussian) while GEd = 0. 

The way to proceed in this scheme i.e., how can, Alice and Bob extract a list of 
classically correlated bits from a set a of symmetric 1x1 entangled modes goes as 
follows: 

i) they agree on a value xq > 0, 

ii) Alice(Bob) measures the quadrature of each of her (his) modes A'^(A'b), 

iii) they make public the modulus of their outcomes, but not the sign and accept 
only outputs such that |xyi| = |xb| = xq, 

iv) they associate e.g., the classical value 0(1) to Xi = +xo(— xq), i = A,B and 
thus establish a list of classically correlated bits. 

Prom there, they can apply Classical Advantage Distillation [11] to establish the 
secret key. This protocol is secure against individual eavesdropper attacks. As the 
protocol is based on output coincidences of the measurements of the quadratures 
which, by definition, are operators with a continuous spectrum, this protocol has 
zero efficiency. 
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1.4 Outline 

Efficiency is a key issue for any experimental implementation of Quantum Cryptog- 
raphy since available resources are not unlimited. Since it is possible to extract a 
secret key a la EckertQl from entangled Gaussian states in the Gaussian scenario 
one important question is to address the efficiency. 

In fact, the protocol suffers from an efficiency problem because the success proba- 
bility of the protocol is vanishingly small. Here we study the consequences of relaxing 
the conditions to a more realistic scenario. We assume that Alice and Bob can ex- 
tract a list of sufficiently correlated classical bits obtained by accepting measurement 
outputs that do not coincide but are bound within a range. We ask ourselves which 
is the possibility that Alice and Bob can still distribute the key in a secure way under 
individual and finite coherent attacks. 

We find that there always exists a finite interval which the protocol can be im- 
plemented successfully. The length of this interval depends on the entanglement and 
on the purity of the shared states, and increases with increasing entanglement. 

In Chapter 2 we review the formalism of Continuous Variable (CV) systems 
focussing on Gaussian states. It will be shown that Gaussian states admit an easy 
mathematical description based on phase space Wigner functions. We will introduce 
also the basic ingredients to describe also systems with entanglement. 

In Chapter 3 we will present ffist a simple academic protocol that permits to 
extract a quantum key from an entangled continuous variable system. Differently 
from discrete systems, Gaussian entangled states cannot be distilled with Gaussian 
operations. However, as we will show, it is possible to extract perfectly correlated 
classical bits to establish a secret key between the sender and receiver. We will then 
demonstrate that this protocol, properly modified, can be made efficient and can be 
implemented with present technology [12]. 

Finally, in Chapter 4, we conclude summarising our results and giving some 
general conclusions and future directions of research. 
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Chapter 2 

Continuous Variable formalism 



This Chapter is intended exclusively to describe Continuous Variable systems and to 
provide the mathematical framework to analyse the problem of QKD in Continuous 
Variable systems. We will focus then on Gaussian Continuous Variable states, which 
describe among others, coherent, squeezed and thermal states of light. Presently 
these states are the preferred resources in experiments of QI using Continuous Vari- 
able systems. For further background information the interested reader is referred 

to o nana [IS]. 

2.1 Continuous Variable system 

A system corresponds to a continuous variable system if it possesses two canonical 
conjugated degrees of freedom i.e. there exist two observables that fulfil the Canon- 
ical Commutation Relations (CCR). The CCR for two canonical observables q and 
p read B| 

[q,p] =il. (2.1) 

It is a direct consequence that they possess a continuous spectra and act in an infinite 
dimensional Hilbert space. 

As examples of CV systems we can think as the position-momentum of a mas- 
sive particle, the quadratures of an electromagnetic field or the collective spin of 
a polarised ensemble of atoms. In all of the three examples above there exist 
two observables fulfilling (|2.1|) . As we will show, they obey the standard bosonic 
commutation relations and so we call these systems bosonic modes. We can deal 
with several modes, and in this case ordering the operators by canonical pairs by 
ff" = {qi,Pi,q2,P2, ■■■,Qn,Pn) we can compactly state CCR as 

[R^,Rj] = [{JN)ij (2.2) 



^Quadrature operators are chosen dimensionless in such a way that h is not going to appear in 
any formula. 
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where i,j = 1,2, ...,2N and Jj\f = ®^^J accounts for all modes while J is the so- 
called symplectic matrix which corresponds to a antisymmetric and non-degenerate 
form fulimiing (i) Vr/, (eR"^^ : (r?! J|C) = -{C\J\v) and (ii) Vr/ : (r?| J|C) = ^ C = 0. 
In the appropriate choice of basis (canonical coordinates) the symplectic matrix is 

brought into the standard form J 



-1 

2.2 Canonical Commutation Relations 

The CCR (|2.ip are related with the classical Poisson brackets via the 1^* quantisation 
transcriptiom {A,B},, = E^(^^ " M^W ^ "^[^'^l = "^^^^ " ^^) 
and A — > A. They can be also described by using the annihilation and creation 
operators a^ and ajt which obey the standard bosonic commutation relations 

^jV = 1,2, ...,N. The CCR in forms (|2.2p and (|2.3p are related by a unitary matrix 
U = l/-v/2 I IT . IT I such that if we define O^ = (ai,a2, ■■■,aN,a\,al, ■■■,a\r) 

then Oi = UijRj . 

The representation of the CCR up to unitaries is not unique. For instance, for a 
single mode in the Schrodinger representation each degree of freedom is embedded in 
Ti = C'^{U.), while the operators q andp act multiplicative and derivative respectively 

' = 'a] (2.4) 

but also q = +i^, p = p is equally possible. In both representations the operators 
are unbounded. 

A way to remove ambiguities (up to unitaries) and to treat with bounded oper- 
ators is using the Weyl operators. The Weyl operator is defined as 

W^ = e<'^-J-^ (2.5) 

where C"^ = (Ci; C2) •••, C,2n)- Then the Weyl operators satisfies the Weyl relation 

W^W^ = e-K^--^-W^+^, (2.6) 

or in an analogous way 

W^W^ = WriWt^e-'^^--^-''. (2.7) 



Theorem 2.2.1 (Stone-von Neumann theorem) Let Wi and W2 be two Weyl sys- 
tems over a finite dimensional phase space {N < 00). // the two Weyl systems are 
strongly continuous fQ and irreducible^^ then they are equivalent (up to an unitary). 



"VIV) G H : limc^o II M ~Wcm\\=0 
^VC e K^^ : [Wc, i] = ^ i ocl. 
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According to the theorem 12.2.11 there exists only one equivalent representation of the 
Weyl relation. 

The Weyl operator acts in the states as a translation in the phase space (displace- 
ments e'^'^lg) = \q — Tj) and kicks e^'^^\q) = e'^'^jg)) as it can be checked by looking to 
its action onto an arbitrary position-momentum operator 

wIr^W^ = R^- Ql (2.8) 

2.3 Phase-space 

Phase space formulation of Quantum Mechanics offers a framework in which Quan- 
tum phenomena can be described using as much classical language as allowed. It 
appeals naturally to one's intuition and can often provide useful physical insights. 
Furthermore, it requires dealing only with constant number equations and not with 
operators, which can be of significant practical advantage. This mathematical ad- 
vantage arises here from the fact that the infinite-dimensional complex Hilbert space 
structure which is in principle a difficult object to work with, can be mapped into the 
linear algebra structure of the finite-dimensional real phase space. We will extend 
this map (j2.3.ip and how to characterise states and operations in sections (j2.4p and 
()2.3.2p respectively. 

2.3.1 Phase space geometry 

A system of N canonical degrees of freedom is described classically in a 2 A^-dimensional 
real vector space u F ~ M^ . Together with the symplectic form it defines a sym- 
plectic real vector space (the phase space) Q ~ M^^. The phase space is naturally 
equipped with a complex structure and can be identified with a complex Hilbert 
space T-Lq ~ C^. If ( | ) stands for the scalar product in TIq and ( | )j for the 
symplectic scalar product in V their connection reads 

{^\0 = {Jv\0j + i{v\0j (2.9) 

where r] = {q,p) £ V while ij = q + ip £ T-Lq such that any orthonormal basis in Ti^ 
leads to a canonical basis in V. Moreover, any unitary operator (which preserve the 
scalar product) acting on T-Lq leads to a symplectic operation S in the phase space in 
such a way that the symplectic scalar product is also preserved. The inverse is also 
true provided that the symplectic operation commutes with the symplectic matrix 
J. 

2.3.2 Symplectic operations 

We hence define symplectic canonical transformation S as these ones which preserve 
the CCR and therefore leave the basic kinematic rules unchanged. That is, if we 



*They are isomorphic (there exist a bijective morphism between the two groups). 
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transform our quadrature operators Rs = S ■ R still equation (|2.2p is fulfilled. In 
a totally equivalent way we can define symplectic transformation as the ones which 
preserve the symplectic scalar product and therefore |£| 

S'^-J-S = J. (2.10) 

The set of real 2N x 2N matrices S satisfying the above condition form the symplectic 
group S'p(2iV, M). To construct the afiine symplectic group we just need to add 
also the phase space translations whose group generators are G\ = JtjRj- Apart 
from that, the group generators of the representation of Sp{2N,M) which physically 
corresponds to the Hamiltonians which perform the symplectic transformations on 
the states are of the form ^{RijRj}- This corresponds to hermitian Hamiltonians 
of quadratic order in the canonical operators. When rewriting them in terms of 
creation / annihilation operators we can divide it into two groups. 
Compact generators (passive): 

A(l) _ . {d'ldi,-ala^) ^(2) _ {d]^d„+ald^) 

and non-Compact generators (active): 

A(3) _ ■ (d'ldl-a^df^) A(4) _ (dlidt+dyd^) 

'-J^fiv — 1 2 ' '-^/i!^ — 2 

The passive ones are generators which commute with all the number operators 
n^ = ajiCLfj^ and so they preserve the total number, in this sense they are passive. 
In case our system corresponds to modes of the electromagnetic field, then, what is 
being preserved is the total number of photons. They can be implemented optically 
by only using beam splitters, phase shifts and mirrors and conversely, only using 
them we can implement any Hamiltonian constructed by a linear combination of the 
compact generators. With all the generators we then have enough to generate all 
the unitaries, Ux = e'^*^. 

As the simplest example for, one mode (A^ = 1) we have the phase shift operator 

Ue = e'^^^^ (2.11) 

which amounts to the symplectic operation in phase space 

Se=h''l ""'/V (2.12) 

ysmt^ cose^ J 

On the other hand we have the active ones, they change the energy of the state. The 
most important one is the single mode squeezing operator (A = 1), whose unitary 
expression for a fixed angle = and squeezing parameter r > reads 



tr = e5(" -'^' ) (2.13) 



^From now on we neglect the subscript A'^ in symplectic matrix. 
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while its symplectic operation in phase space reads 



iJ'r- 



e-^ 
e'' 



(2.14) 



Finally phase space translations for one mode whose unitary is Ua = e' 



aa'^ —a*a 



where 



a 



(go+ipo) 



^^=^, amounts to the symplectic operation in phase space as Sq, = I 

The most important non-trivial unitaries for two modes {N = 2) are beam splitters 
Ubs = e2("i"2-"i'^2) (-g^^ fixed angle </> = 0, reflectivity R = sin^ 9/2 and transmitivity 
T = cos^ 6/2) and two mode squeezings Utms = e^^"'^"'^""'^"'^) that amounts to 



Sbs 



( cos 61/2 sin 61/2 \ 

cos 61/2 sin 61/2 

-sin 61/2 cos 6^/2 

V -sin 6^/2 cos 6/2 J 



(2.15) 



and 



Stms 



/cosh r 

cosh r 

sinh r 

\ — sinh r 



sinh r \ 

— sinh r 

cosh r 

coshr J 



(2.16) 



2.4 Probability Distribution functions 



One of the most important tools of the phase space formulation of Quantum Mechan- 
ics are the phase space probability distribution functions. The best known and widely 
used is the Wigner distribution function, but there is not a unique way of defining 
a quantum phase space distribution function. In fact, several distribution functions 
with different properties, rules of association and operator ordering can also be well 
defined. For instance sometimes normal ordered (P-function), antinormal ordered 
(Q-function), generalised antinormal ordered (Husimi- function),... distributions can 
be more convenient depending on the problem being considered. In this dissertation 
we are only going to work with the totally symmetrical ordered (Weyl ordered) one, 
the Wigner distribution function. 

Due to the fact that a joint probability at a fixed position q and momentum p 
point is not allowed in Quantum Mechanics by Heisenberg uncertainty theorem, the 
quantum phase space distribution function should, therefore, be considered simply 
as a mathematical tool that facilitates quantum calculations. Joint probabilities can 
be negative, so that one deals with quasiprobability distributions as long as it yields 
a correct description of physically observable quantities. 
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2.4.1 Quantum states 

At the level of density operators, p defines a quantum state iff it satisfies the following 
properties 

trp = l, /5>0 [^ P^ = p\- (2.17) 

This operator belongs to the bounded linear operators Hilbert space B{T-L). For pure 
states the ket and wave function formulation is enough to describe our state. There, 
a state lives in a Hilbert space C for qudits, (a system of discrete variables) or 
£^(M^) for A^ modes, (a system of continuous variables). 

For systems of continuous variables, the Wigner distribution function gives a 
complete description of the state. Given a state p (a single mode) we define the 
Wigner distribution function as|j 

Wp(g,p) = - f dx{q + x\p\q-x)e-^'P''. (2.18) 

This transformation is called Weyl-Fourier transformation and it gives the bridge 
between density operators and distribution functions. Sometimes, for computational 
reasons it is better to compute first the characteristic distribution function which is 
obtained through 

Xp{C,v)=tT{pW^Cv)}- (2-19) 

The above two distribution functions are fully equivalent in the sense of describing 
completely our quantum state and are related by a Symplectic-Fourier transform 

Wp(g,p) = ^j dcj dr^Xp{C.ri)e--<P+'^'^ = l-SFT{xp{C,n)}, (2.20) 

Xp{Q,v) = j dq j dpWp{q,p)e<^-'^'i = 27,SFT-\Wp{q,p)}. (2.21) 

The Weyl-Fourier transformation is invertible and it provides a way to recover our 
density operator from both distribution functions 

P=^ I dq I dp [dC /dr?Wp(g,p)e-i'^P+^^W(_^,_^) = 

" 2^/ ^W dVXp{C,V)W(.(;,-v)- 

At this level, W (and x) defines a quatum state iff they satisfy the following prop- 
erties 

ldqldpWiq,p) = l, j dqj dpW{q,p)Wp{q,p)>Q [^ W*{q,p) =yV{q,p)\ 

(2.23) 

®For pure states the definition gets simplified to W'p(g,p) — — j dxe~^^'''^ip*{q — x)ip{q-\- x). 
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for all pure states Wp and 

2N 

X(0,0) = 1, Yl <^>3X{Cj-Qe^^^'^-'-^'^ > K X*{C,V) = Xi-C-V)] (2.24) 

for all Uij £ M. This can be shown using the following theorem. 

Theorem 2.4.1 (Quantum Bochner-Khinchin theorem) For x{v) ^^ be a character- 
istic function of a quantum state the following conditions are necessary and sufficient 
^■) x(0) = 1 '^iT'd xiv) ^s continuous at rj = 0, 
2.) xiv) is J — positive (symplectic-positive defined). 

2.4.2 Properties of the Wigner distribution 

Properties 

i) Quasidistrihution: It is real valued quasidistribution because it admit negatives 

values (a Quantum Mechanics signature). 

ii) T-symmetry: It has time symmetry 

t^-t^^W{q,p,t)^W{q,-p,t). (2.25) 

Hi) X-symmetry: It has space symmetry 

g^-g^^n;(g,p,t)^>V(-g,-p,t). (2.26) 

iv) Galilei invariant: It is Galilei invariant 

q^q-a^^ W{q,p, t) ^ W{q + a,p, t). (2.27) 

v) T-evolution: The equation of motion for each point in the phase space is classical 
in the absence of forces [j 

dp If-. £,1 ^ dW{q,p,t) p dW{q,p,t) 

-17 = --[P,^\^^ ^: = ^ • ^^-^^f 

at I at m oq 

vi) Bounded: It is bounded |j 

\W{q,p)\ < -. (2.30) 

vr 



^Remember that when we are speaking about states of light m has to be interpret as permittivity 
of vacuum eo while there is a minus sign difference with Heisenberg's equation of motion. 

'4-\[A,H]. (2.28) 

*Use Schwarz's inequality |(V'i|''/'2)P < {''/'i|V'i)(V'2|V'2) at the density operator level i.e. < 
tr(pip2)" < tr(pi)"tr(p2)"'. (no es ven be la dem) 
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vii) Normalised: It is well normalised 

I dq I dpWiq,p) = l. (2.31) 

via) Quantum m,arginal distributions: It possesses good marginal distributions g 

ldpW{q,p) = {q\p\q)>0 (2.32) 

dqW{q,p) = {p\p\p) > 0. (2.33) 

ix) Complete orthonormal set: The set of functions y^nmil^p) form a complete or- 
thonormal set (if ipnil) are already a set) 

dq dpW^^iq,p)Wn'm'iq,P) = l^-^nn'^mm' (2-34) 

Y.^nm{q,P)y^nm{q' ,P) = ^S{q - q')5{p - p') (2.35) 

n,m 

where 

Wnra{q,p) = ^ / dx 6-2^^-^(9 " a;)V'm((7 + a;). (2.36) 

2.4.3 The generating function of a Classical probability distribution 

Denoting by y {x) a random variable which can be discrete y € {yi} (or continuous 
X E [a, 6]) and its corresponding (density) probability p{yi) {p{x)), we can establish 
the normalisation constrain as 



E,j, PiVi) = 1 
f p{x)dx = 1 



(2.37) 



Of relevant importance given a probability distribution are the following quantities: 

i) Mean value of u{x): E[u{x)] = J u{x)p{x)dx. 

ii) Moment of order m respect point c of x: d^ = E\(x — c)™]. 

Hi) Mean value of x: /i = aj = E[x]. 

iv) Standard deviation of x:Y^ o = a/«^ = \/-E[(x — pY\. 

v) Covariance of Xi and xj.-lj Cij = cov(xj,Xj) = E[{xi — Pi){xj — fij)] 
where i,j = 1, 2, ..., 2N. 

^For pure state they correspond to the square modulus of the wave function in position |i/'(9)P 
and in momentum |'i/)(p)p representation. 

^"Square root of the variance. 

^^Here subindex i,j labels all the possible variables of the distribution, when they are equal, Cu 
corresponds to the variance of the variable Xi. 
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Theorem 2.4.2 (Taylor's theorem) Any well behaved distribution function can be 
reconstructed by its (in general) infinite moments. 

This theorem, of considerable importance, tell us that any distribution p{x) can 
be retrieved only by its moments a™ . We define the vector d and the matrix C called 
mean vector and covariance matrix by 

C = [[cov{xi,Xj)]] \ , 

d = [k]] /• ^^■^^> 

What is more important is that d and C encode all the information of 1®* and 2°*^ 
moments. 

If we define the generating function of the distribution function by a Laplace 
transformation (provided it exists) 

M{7]) = Cr{p{x)} = E[e^^] (2.39) 

all moments can be obtained by subsequently differentiating the generating function 

a("^)M(7?) , 

2.4.4 The generating function of a quasi-probabihty distribution 

In the same way as in Classical Probability where all the moments of a distribution 
characterise the distribution, the Wigner quasidistribution function is fully charac- 
terised by its moments. 

To adapt the classical formalism to the quantum Wigner quasidistribution func- 
tion we have to introduce the following transcription r] — > ir], M — > x, ^T — > TT. 

We then define the generating function of the Wigner distribution (characteristic 
function) by a Fourier transformation, which always exists, because the Wigner 
distribution is an integrable function. In general it is complex and reads 

X{^) = FT{W{x)} = i?[e-^] (2.41) 

then all moments can be obtained by subsequently differentiating the generating 
function 

^ ^^i_^a^| (2.42) 

Analogously, we define, given a quantum Wigner distribution function the dis- 
placement vector (DV) d (a 2N real vector) and the covariance matrix (CM) 7 (a 
2N X 2N real symmetric matrix). The DV contains the information of the first 
moments and in general plays no role, by the space symmetry only relative DVs are 
of physical meaning. The CM is much more richer, it contains information (up to 
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second moments) about the purity, entanglement, ... The CM to describe a physical 
state must be symplectic-positive defined 



7 + iJ>0. (2.43) 



2.5 Gaussian states 



Among all the CV systems Gaussian states are of greatest importance. The Gaussian 
distribution is simple, it is the limit of many others and appears in a great variety 
of different conditions. In order to give a motivation we state here one of the most 
important theorems (together with the Law of Large Numbers) of the Theory of the 
Classical Probability and Statistics, the Central Limit Theorem. 

Theorem 2.5.1 (Central limit theorem) Suppose we have n independent random 
variables xi,X2, ■■■,Xn which are all distributed with a mean value fi and a standard 
deviation a (each of them can have different arbitrary distribution functions pi{xi)). 
In the limit n — )• cxd the arithmetic mean x = - X^ILi ^i ^* Gaussian (or normal) 



distributed with mean value 



fj, and standard deviation -y= i.e. p{x) 



1 



2na 



Another way to see the importance of Gaussian probability distributions is en- 
coded in the following theorem 

Theorem 2.5.2 (Marcinkiewicz's theorem) If we define the cumulant generating 
function as K{rj) = In M(r/), then, either the cumulant is a polynomial of order 2 or 
it has infinite terms. 

Lemma 2.5.1 (Gaussianity lemma) As a consequence thenp{x) is a Gaussian(non- 
Gaussian) distribution iff the cumulant is a polynomial of order 2(oo). 

In general all moments are necessary but as long as we are concern with only 
Gaussian distributions, 1*^* and 2 moments are sufficient, in fact all other higher 
moments can be rewritten in terms of them. This is a consequence of the theorem 
[2X21 

2.5.1 Displacement Vector (DV) and Covariance Matrix (CM) 

An important class of quantum states are Gaussian states. They can be defined as 
all quantum states whose Wigner distribution function is Gaussian. Thus the DV 
and the CM are enough to describe them. Analogously to the classical case, it is 
straightforward to obtain the moments of order /3™ of a distribution by differentiating 
the generating function. Computing 1*^* and 2"^^^ moments, through (|2.19p we get P^l 



i^Notice: (gf-e'" ■«)|,,=o = iR^ and isig^e"^ ■^)k.,,=o = llR.,R,] - R^Rj = -HR^,R,} 

il-*'-^! (when [A,B] ocl). 
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Pl,i = -i^x(r?)|,=o = t^pR'i) (2.44) 

Phj = (-i)' 9;^^(^)l^=o = ^tr(/5{i?'„ R',]) = tiipR'd'j) - ^J^J (2.45) 

where R'i = JRi. 

Finally we define the DV and the CM as [£| 

di = tiipRi) (2.46) 



7ij- = tT{p{R, - dii, Rj - dji}) = 2tT[p{Ri - d^i){Rj - djl)] - Uij 
= 2Re{tr[^(^, - dil){Rj - djl)]} 



(2.47) 



It is important to remark here that symplectic operations at the level of the DV 
and CM act in such a way that any unitary tls maps to the following transformation 
75 = S -J- S"^ and ds = d + s where S stands for an element of the symplectic group, 
while s stands for a phase space translation. 

With these definitions it can be shown that the Wigner distribution of any Gaus- 
sian state can be written in terms of the DV and CM through o 

while its symplectic-Fourier transform reads 

X{r]) = e^'^'^-J-d-v'^-J'^lJ-v = ^iv'^-d'-v'^-i-v (2.49) 

where 4 = Jijdj and 7^ = Jf^lkiJij- 

Theorem 2.5.3 (Minimum uncertainty states theorem) Equality in Heisenberg's 
uncertainty theorem is attained iff the state is a pure Gaussian state i.e. a rotated 
squeezed coherent state, \ip) = UgUrUa\0) . 

All pure Gaussian states of one mode, characterised by its 7 (and if necessary by 
d), can be obtained from the vacuum state by an arbitrary displacement+squeezing+rotation 
in the phase space. These states, by theorem 12.5.31 are minimum uncertainty states. 



""^^ For pure states di — {Ri)p and 7^^ = {{Ri ~ dil, Rj ~ djl}) p = {{Ri, Rj})p — 2{Ri)p{Rj)p, where, 
by the anticommutator definition, we see a factor 2 of difference with the classical analog and so 
7i-,- ~ 2Cij. The diagonal terms can be rewritten in terms of the uncertainties as 7,1 = 2{ARi)^ 

where as usual (AA)^ = ij {A'^)^ — {{A)^y. 

^"We see here that from (|2.30p max [VV(C)] = W(d) = ^^^ }^^^ < ^ where the equahty holds 
for pure states only. 
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Instead, mixed Gaussian states of one mode can be all obtained from a thermal state 
by an arbitrary displacement+squeezing+rotation. 

As the cornerstone examples of Gaussian states, we have the vacuum, coherent, 
squeezed and thermal states. 

* Vacuum: |0) 

■'■•' = (J i) ■ "" = (o) ■ <'-™> 

*(Pure) Coherent:^ \a) = P(a)|0) = Ua\0) 



la = SaJoSa = ( n -, ] , d^ = (Iq + Sa = i ^ ] , (2.51) 



where a = aR + ia/ = '^° ^° . 



* 



(Pure) Squeezed: |r) = 5(r)|0) = f/^IO) 

7r = SrJoSj = i Q ^2r ] ' dr = do + Sr = i^j ■ (2.52) 

*(Mixed) Thermal: ^^ = ;^ /(i2a|a)(a|e-l"l'/^^ 

^/^=CV^ 2M°+l)' '^^=(0)' (^-^^^ 

where M = ^_ > being /? the inverse temperature. 

2.5.2 Hilbert space, phase space and DV&CM connection 

We have already shown how to describe quantum states and operations at the differ- 
ent levels i.e. Hilbert space, phase space and DV&CM. Two main connections are 
needed still to perform calculations in the phase space: the ordering of the operators 
and the metric between them. 

The Weyl association rule tells us about the ordering operators. Provided we 
are using with the Wigner distribution, which is symmetrical ordered, when working 
with observables we have to take into account that as we are in the phase space and 
we have avoided its operator character we have to symmetrise them. The way we 
have to symmetrise is 

giC^+iw ^. giCa+iw .— giCa+iw ^ y g^Kg+ivp (2.54) 

where : : stands for the symmetrical order. In general for a polynomial on q and p 



^^A Coherent state can alternatively be defined as the eigenstate of the annihilation op- 
erator, a I Of) = a\a). Coherent states form an overcomplete non-orthogonal {{a\a') — 
exp[—{\af + \a'f)/2 + a*a']) set base {- Jd^a\a){a\ =1) of vectors of the Hilbert space. 
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r=0 ^^^ r=0 ^^^ 

(2.55) 

As an example take the observable QP, its quantum associated operator is of 
course qp. We know that q and p do not commute but in the phase space qp and 
pq are functionally treated in the same way. Imagine we need to find its average 
value, we have then to remove the ambiguity by totally symmetrising. The recipe is 
qp — >: qp := 3S-J11 ^ — ). qp_ And so the average to be performed is 

< QP > = < qp >p=< qp + i/2 >w (2.56) 

because 

_ qp + pq 

qp= +1/2. (2.57) 

More important and relevant averages concern the moments which can be ob- 
tained via the Wigner distribution as 

d, = tvipR,) = j <f^C [0] W(C) (2.58) 

7ij = iT{p{R, - d,% Rj - dji}) = I d^^C [2(0 - d,){Cj - dj)] W(C). (2.59) 

Theorem 2.5.4 (Quantum Parseval theorem) Let W(^ be a strongly continuous and 
irreducible Weyl system acting on the Hilbert space T-Lq with phase space Q. Then 
A I—)- tr{j4W^}, with (^ £ Q, is an isometric map from the Hilbert space % (Hilbert- 
Schmidt operators) onto the Hilbert space £^(0) (square-integrable measurable func- 
tions on n) such that 

tr(it^) = ^ I d'^'C tr{AW^rtT{BWc}. (2.60) 

This theorem is of capital importance, it follows from it how to compute the 
scalar product between operators 



tr{it5} = ^ jd^'^ii A^*{r^)B^{i^) = 
= ^/^^^^^(C)i?^(C), 



(2.61) 



the trace of an operator [^ 

tr{i} = A^O, 0) = j^ I d'^'C A'^iO, (2.62) 

i^Use that I^ = 1 and I^ = (27r)^(S'^^'(r7) computed from eq. I^M^ and eq. (|2J5)) . 
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and the expectation value of an observable 

(2.63) 



{A), = tr{M} = j^ J d'^'v X*{v)AHil) 



d^^C W(C)A^(C)- 

To justify the above expression we just need to define properly the Fourier- Weyl 
transform as 



A = TWT{AHrj)} = .^jd'^^v AHvW-r, 



(2.64) 



and its inverse 



A^{ri) = FWT'^{A} = trjiW"^}, (2.65) 

A^{C, r?) = 2^ / d^\ (C + A|i|C - A)e-2i*'^ (2.66) 

where C"^ = (Ci> C2, ■••, Ca^) idem for fj. 

A^{C) = STT{A^iv)} = j^ I d'^'v AHr^)e-'<^-J-\ (2.67) 

AXir^)=STT-'{A'^iO}E=j^Jd''^C A^iOe'^^^-J-^. (2.68) 

An important concept in Quantum Information is the fidelity J-' between quantum 
states. The one we adopt here is the so called Bures-Uhlmann fidelity and it is defined 
as follows 



T{p,,P2) = [tv^Jpy'p2py']\ (2.69) 

It is symmetric and normalised between 1 (equal states) and (orthogonal states). 
Its definition is simplified when one of the two states is pure (say pi), in this case it 
converges to the Hilbert-Schmidt fidelity 

J-(pi,/>2) = tr(/5ip2) = (V'i|/>2|V'i>- (2.70) 

In case both states are pure, then, the fidelity becomes simply the overlap between 
the two states 

T{pi,P2) = \{iPi\i^2)\^- (2.71) 



^^Notice that A^ — (27r)^W ii A — p see eq. (I2.18|) (for normalisation convenience) 
^^Notice that ^'^ = x if ^ = P see eq. (pTTO)) . 
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It is useful here to use theorem 12.5.41 to evaluate the Hilbert-Schmidt fidelity 
between two Gaussian state (at least when one is pure) l£I 



^ipl,P2) =tr(/5i/92) 



^) j cP''vX*MX2{v) = (27r)^|d2A.CWi(C)>V2(C) 



-dT(—^)d 
-g ^71+72 



det( 



71 +72 ' 



(2.72) 
where 71(2) and di(2) belongs to Pi{2)-, while d = d2 — di. 

Another important concept in Quantum Information is the purity 7^ of a quantum 
state. The purity is defined as follows 

V{p) = tr(p2) (2.73) 

It is normalised between 1 (pure states) and (maximally mixed states). Also 
here using theorem 12.5.41 we can evaluate the purity of a Gaussian state o 

V{p) = {2^r I d^\ [y^iO? = -^J^ (2.74) 

2.6 Multipartite states and entanglement 

If we want to treat the entanglement of a quantum state, first we need to introduce 
multipartite states. In general we have to extend the Hilbert space. At the level of 
density operators this means that we have to "tensor product" (8), the Hilbert space of 
each party i.e. 71 = ^^^iT-Lk- The covariance matrix structure for Gaussian states 
turns to be simplified to a "direct sum" ©, of each party's associated phase space i.e. 
Vt = ©fc=i ^k- This is reminiscent of the Quantum Parseval theorem, which trans- 
forms tensor product between density matrices to products of Wigner functions (and 
Characteristic functions) and at the same time direct sums of covariance matrices. 

Therefore, the advantage of using Gaussian states is that we fully describe a state 
by a finite dimensional 2x2 matrix instead of its infinite dimensional density matrix. 
Additionally, dimensionality of the phase space increases slower, as dimensions are 
added instead of multiplied, c^ 

2.6.1 Bipartite Gaussian states 

[A C 
Any bipartite Gaussian state can be written in a block structure as 7 = I „^ 

where A = A^ and B = B'^ . 



^^The second and third equality is true for all CV states. 
^^The first equality is true for all CV states. 

2lT 



Remember that dim(pi ® P2) = dini(pi) Aira[p2) while dim(7i © 72) = dim(7i) + dim(72). 
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Continuous Variable formalism 



Lemma 2.6.1 (Normal form) Every 1x1 mode Gaussian state can be transformed 
(by two local symplectic transformations) to 



fXa 



o\ 



7 



Xa K 



Vo 



Xb 
kp XbJ 



(2.75) 



If we define the four invariants of an arbitrary state A = detyl, B = detB, 
C = det C and T = det 7, then the following holds 



Xa 



A 
B 

-{a - \J, 



a^ 



AC) 



kp = -{a + y/a'^ -AC) 



a 



^M+cy-T, 



/AB 



(2.76) 



Lemma 2.6.2 (Standard form) Every 1x1 mode Gaussian state can be transformed 
(by local quasi-free symplectic transformations) to 



(Xa 





f^x 


\ 





A„ 





rCp 


•^x 





Ab 





Vo 


—kp 





Xb 1 



(2.77) 



where Xa^Xb > 1 and kx > \kp\. 

A Gaussian state in the Standard form is called symmetric if Xa = Xb, and fully 
symmetric if it is symmetric and in addition kx = kp. 

2.6.2 Entanglement of Gaussian states 

For discrete variable systems an important separability criteria based on the partial 
transpose (time reversal) exists. 



Lemma 2.6.3 (NPPT Peres criteria) Given a bipartite state p, if it has non-positive 
partial transpose (fF^ ^ =^ fP"^ ^ 0), then p is entangled. 

Lemma 2.6.4 (NPPT Horodecki criteria) In V? ®€? and C^CS'C'^ given a bipartite 
state p, it is entangled iff it has non-positive partial transpose (p^^ ^ =^ fP"^ ^ Oj. 
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For continuous variable states, Peres criteria also holds while Horodecki criteria 
is true provided our state is composed of 1 x A^ modes. In particular for Gaussian 
states, time reversal is very easy to implement at the covariance matrix level. If T is 

the reversal operator then St = = i i ) ^^ ^^^ symplectic operations in phase 

space. So we can rewrite the lemma [2.6.41 for Gaussian states as 



Lemma 2.6.5 (NPPT Horodecki's criteria) For IxN modes given a bipartite Gaus- 



sian state 7, it is entangled iff it has non-positive partial transpose (Oa'/Ga + ^"^ 



=> ObiOI + iJ ^ 0;. 

Concerning entanglement measures we use as an entanglement measure for pure 
state the Entropy of entanglement and for mixed ones the Logarithmic negativity. 

*(Pure states) Entropy of entanglement: 

Es{p) = S{pa) = -tr(pA log pa), (2.78) 

where S is the von Neumann Entropy CJ S{p) = —ti{p\ogp), and pA is the trace 
over B defined as pA = trB(/5). For any state it reduces (in terms of the Schmidt 

coefficients) to 

00 

Es{p) = -Y.C^\ogCl (2.79) 

i=0 

while for Gaussian states, 

^.(7) = -E[(^)log(^) - (^)log(^)], (2.80) 

where {pi\ = spec(— iJ7A). 

* (Mixed states) Logarithmic negativity (additive monotone): 

EN{p) = LN{p) = \og\\fF^\\r, (2.81) 



where|| ||i is the trace norm defined as ||/>||i = tr|yo| = \,t\J p^ p = ^singularvalues(p). 
For Gaussian states, 

N 

En{i) = - J^log[min(/li,l)], (2.82) 

where {pi} = spec{—iJj^^). 



^The logarithm is in base 2. 
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Continuous Variable formalism 



2.7 Appendix of integrals 






Gaussian integrals: 






/ -C-.A.C^27V^ ^ 


^^ 


(2.83) 


VdetA 


fe-C^-^<-'^^<d'^C = 


/ 1 , A 


(2.84) 



Non-Gaussian integrals: 



^N Qnii QtUj Qnik 






Vd^tAdbT' dbT db"^' 



■■e tA 



(2.85) 



bi=0,bj=0,bk=0,- 



(-1) 



Useful integrals: 



■mi+mj+mk+--- 



Vd^tAdbT'dbT'db"^' 



■■■e 



ib+c)T.^.(b+c) 



b,=0,6j=0,bfe=0,- 



W(C)d''X=l 






1 



(27r)^Vdit^ 

ML 

\/det7 



e T 



(x(r/)) d 7? = ^=^e ^ 
(2^)^ 



IxivWd'^'r^ 



\/det7 



(2.86) 

(2.87) 
(2.88) 
(2.89) 
(2.90) 
(2.91) 



Chapter 3 

Efficiency in QKD protocols 
with entangled Gaussian states 



Efficiency is a key issue in any real implementation of a cryptographic protocol since 
the physical resources are not unlimited. We will first show that Quantum Key Dis- 
tribution is possible with an "Entanglement based" scheme with NPPT symmetric 
Gaussian states in spite of the fact that these systems cannot be distilled with Gaus- 
sian operations (they are all bound entangled). In this work we analyze the secrecy 
properties of Gaussian states under Gaussian operations. Although such operations 
are useless for quantum distillation, we prove that it is possible to distill efficiently a 
secret key secure against finite coherent attacks from sufficiently entangled Gaussian 
states with non-positive partial transposition. Moreover, all such states allow for 
efficient key distillation, when the eavesdropper is assumed to perform individual 
attacks before the reconciliation process. In section ()3.ip we present the academic 
protocol [5j, while in section (|3.2p we present the way to perform QKD with in the 
protocol in an efficient way. 

3.1 State of the problem: QKD with entangled Gaus- 
sian states 

Before presenting the protocol it is important to notice that Gaussian states always 
admit a purification. Thus, any mixed Gaussian state of N modes can be expressed 
as the reduction of a pure Gaussian state of 2N modes of the form: 



_ , In Cn 



J, CN = JN^J-{JNlN?-ieN, 0iV = 0l 

/ -.—1 



such that the mixed state can be obtained after tracing out A^ modes from 72Ar. 
Here 9 = ( J _?^ ) , which is the momentum reflection in phase-space, is the associated 
symplectic operation. 



30 Efficiency in QKD protocols with entangled Gaussian states 



For what follows it is also important the fact that any NPPT Gaussian state can 
be mapped by Gaussian Local Operations and Classical Communication (GLOCC) 
to an NPPT symmetric state of 1 x 1 modes i.e. preserving the amount of entangle- 
ment. 

As the last remark, to deal with the content of the entanglement in Gaussian 
states we are going to use the negativity. As it was stated in section ()2.6.2p , in terms 
of CMs and for 1x1 and 1 x A^ modes of bipartite Gaussian states the PPT criterion, 
which tells us that a state p is entangled if and only if it has non positive partial 
transposition, reads ^^7^5 + i J < 0. 

With all the formalism at hand we now review the main steps of the protocol used 
in [5j. Without loosing generality, and by virtue of the above properties of Gaussian 
states, one should only consider the case in which Alice and Bob share many copies of 
a quantum system of 1 x 1 symmetric NPPT Gaussian state pab ■ To extract a list of 
classically correlated bits to establish a secret key, each party measures the quadra- 
tures of her/his mode Xa,b and accepts only those outputs xa,b for which both par- 
ties have a consistent result \xa\ = \xb\ = xq. With probability p{i,j), each party 
associates the classical bit i = 0(1) to her/his outcome +xq{—xo). The probability 
that their symbols do not coincide is given by eAs = iY^iJ,jPihJ))/{J2ijPi'''^J))- 
Having fixed a string of M classical correlated values, they can apply Classical Ad- 
vantage Distillation [llj. To this aim, Alice generates a random bit b and encodes her 
string of M classical bits into a vector b of length M such that bAi + bi = b mod (2). 
Bob checks that for his symbols all results bsi + bi = b' mod (2) are consistent, and 
in this case accepts the bit b. The new error probability is given by 

(eABJ^'^ ^ ( eAB \ ,„,s 

(1 - cabY^^ + [eABr^^ \1-€abJ 

which tends to zero for sufficiently large M. The most general scenario for eavesdrop- 
ping is to assume that Eve has access to the states before their distribution. Hence, 
the states that Alice and Bob share correspond to the reduction of a pure 4-mode 
state. We consider two types of attacks: (i) individual (or incoherent) attack, where 
Eve performs individual measurements, possibly non-Gaussian, over her set of states 
and (ii) finite coherent (or collective) attack, where Eve waits until the distribution 
has been performed, and, decides, which collective measurement gives her more in- 
formation on the final key. Now, security with respect to individual attacks from the 
eavesdropper Eve, can be established if 

M 

"^^ ^ <Ke++|e__)r, (3.2) 



1 -e.AB 

where \e±±) denotes the state of Eve once Alice and Bob have projected their states 
onto I lb Xq). Notice that Eve can gain information if the overlap between her states 
after Alice and Bob have measured coincident results is sufficiently small. The above 
inequalities come from the fact that in the case of individual attacks the error on 
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Eve's estimation of the final bit b is bound from below by a term proportional to 
|(e++|e )|^^ [5j. Therefore, Alice and Bob can establish a key if 

-^^^<Ke++|e__)|. (3.3) 

1 - ^AB 

In [S] it was shown that any 1x1 NPPT state fulfils the above inequality and thus 

any NPPT Gaussian state can be used to establish a secure key in front of individual 

eavesdropper attacks. If we assume that Eve performs more powerful attacks, namely 

finite coherent attacks, then security is only guaranteed if the much more restrictive 

condition 

-i^^<Ke++|e__)|2 (3.4) 

1 - CAB 

is fulfilled. This new inequality is violated by some NPPT states. Notice that 

this implies that the analysed protocol is not good for these states in this more 

general scenario. Nevertheless, using the recent techniques of |17] . one can find 

states for which the presented protocol allows to extract common bits secure against 

this attack. 

3.2 Efficient QKD with entangled Gaussian states 

Let us now present our results. Notice that since security relies on the fact that 
Alice and Bob have better correlations than the information the eavesdropper can 
learn about their state, perfect correlation is not a requirement to establish a secure 
key. We denote Alice's outputs by xqa and we calculate which are the outputs Bob 
can accept so that the correlation established between Alice and Bob outputs can 
be used to extract a secret bit. 

We use the standard form of a bipartite 1x1 mode Gaussian state, 

\ 


XbJ 

with Xa,b > 1, and Cx > \cp\ > (we can shift the displacement vector to 0). 
We shall deal with mixed symmetric states and so Xa = Xb = X. The positivity 
condition reads (A — Cx){X + Cp) > 1, while the entanglement NPPT condition is 
given by (A — Cx){X — Cp) < 1. As in [5j, we impose that the global state including 
Eve is pure (she has access to all degrees of freedom outside Alice an Bob) while the 
mixed symmetric state, shared by Alice and Bob is just its reduction, 



lAB 



(Xa 





Cx 





Xa 





Cx 





Xb 


\o 


-Cp 






(3.5) 



lABE=y^? 07^50^)' (^-^^ 



C = Jab\/-{JabiabY - 12 



/ -X -Y\ 

-X -Y 

-Y -X 

\-Y -X / 



(3.7) 
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where 



Bab = Oa 



X 



Jab = Ja® Jb, 



(3.8) 



\/a + b + \/a — b 



Y 



\/a + b — \/a — b 



and a = X^ — CxCp — 1,6 = X{cx — Cp). 

Performing a measurement with uncertainty o", the probabihty that Ahce finds 
=b|xoA| while Bob finds ±|a;os|, is given by the overlap between the state of Alice and 
Bob, pAB, and a pure product state pA,i®PB,j (with i,j = 0, 1) of Gaussians centred 
at ib|xoA|(i|a^oB|) respectively with a width (notice pA,o = \ + |a;oA|)(+|a^oA||)- We 
use here the Hilbert-Schmidt fidelity for calculation, which gives: 

p(0, 0) = p{l, 1) = tT[pAB{PA,0 ® PB,o)] = 

= i27r)^ J d\ABW,^ACAB)Wp^,,^p,^,iCAB) = 

' 2\xoa\\xob\cx - (A + a-2)(x^^ + ^obI 



(3.9) 



K{a) exp 



(X + a^y-d 



for the probability that their symbols do coincide and, 
p(0,l)=p(l,0)=i^(^)exp 



2\xoa\\xob\cx - (A + o-^)(x^^ + xl^] 



(X + a^r-cl 



for the probability that they do not coincide, where 

4^2 



Kia) 



V(A + a2)2-c2^(Aa2 + 1)2 - cja^ 
Their error probability for o" — )■ reads 

T.i^jP{hj) _ 1 



(3.10) 



(3.11) 



CAB = lim 



"^^ HijPihJ) 1 + 



4cj,|xoA||a:oB| \ 



(3.12) 



e^P \^-ci 



Let us calculate the state of Eve \e±±) after Alice has projected onto | it |xoa|) and 
Bob onto I lb |xo_b|): 



7++ = 7- 



7x 
7.-^" 



7x 



A Cx 
Cx X 



( 



d±± ==F 








\ 



A6xq — BAxq 
\A6xo + BAxqJ 



(3.13) 



(3.14) 
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/a+b 



/a—b 



where A 



-j^, B = j^, Axo = |xob| - |xoa| and 6x0 = \xob\ + \xoa\. The 
overlap between the two states of Eve is given by: 



\e-)\' 



exp 



A2 



,2 



'^OB 



)(A^ 



1)A+ 



+ la^oAlkoel (cx - Cp(A^ - c^)) 



. (3.15) 



Substituting Eqs. (|3.12p and p.lSp into (jS.Sp one can check, after some algebra, 
that the last inequality reduces to: 



X, 



OA 



''OB 



(A^ 



cl 



1)A + |xoa||2;ob| {-Co: - Cp{X- 



ci)) < 0. 



(3.16) 



Notice that condition ()3.16p imposes both, restrictions on the parameters defining 
the state {\,Cx,Cp), and on the outcomes of the measurements {xoa,xob)- The 
constraints on the state parameters are equivalent to demand that the state is NPPT 
and satisfies 

(A-c,)(A + c,)>l. (3.17) 

Nevertheless, as Cx > Cp, any positive state fulfils this condition. Hence for any 
NPPT symmetric state, there exists, for a given xqa, a range of values of xqb such 
that secret bits can be extracted (Eq. (|3.3p is fulfilled). This range is given by 



Axo = \xob\ - \xoa\ G '^a 



--y/a — 1 ' ^/a — 1 



\xoa\ 



where 



a 



Cx + A 



l-(A + Cx)(A + Cp) 
1 - (A-Cx)(A-Cp) 



(3.18) 



(3.19) 



After Alice communicates \xoa\ to Bob, he will accept only measurement outputs 
within the above interval. The interval Axq is well defined if q > 1, which equals to 
fulfil Eq. (|3.17p . Notice also that the interval is not symmetric around {xqaI because 
the probabilities calculated in Eqs. ()3.9p and ()3.10p do depend on this value in a 
non-symmetric way. The length D^ of the interval of valid measurements outputs 
for Bob is given by 

4Va 



Da 



a 



1 



\X0A\ 



(3.20) 



It can be observed that maximal Da — t- 00 (q = 1) corresponds to the case when 
Alice and Bob share a pure state (Eve is disentangled from the system) and thus 
condition (j3.3p is always fulfilled. On the other hand, any mixed NPPT symmetric 
state (a > 1) admits a finite Da- This ensures a finite efficiency on establishing a 
secure secret key in front of individual attacks. 
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If we assume that Eve performs more powerful attacks, namely finite coherent 
attacks, then security is only guaranteed if [5]: 



f^AB 



1 -eAB 



<Ke++|e-)P 



(3.21) 



This condition is more restrictive than (j3.3p . With a similar calculation as before we 
obtain that now security is not guaranteed for all mixed entangled symmetric NPPT 
states, but only for those that also satisfy: 



X - {X + c^){X - c^){\ - Cp) >0. 



(3.22) 



For such states, and given a measurement result xqa of Alice, Bob will only accept 
outputs within the range: 



where 



Axo = \xob\ - \xoa\ G 1^13 

2A(A2 - 



.^_l'^_lj 



\xoa\ 



P 



ci-i) 



> 1. 



(3.23) 



(3.24) 



A - (A + Ca;)(A - Ca;)(A - Cp) 

As before, /3 > 1 is fulfilled by conditions (IXTTD and IKm . 

Let us now focus on the efficiency issue. We define the efficiency £'(7^^) of the 
protocol for a given state 'Jab, as the average probability of obtaining a classically 
correlated bit. Explicitly, 

E{'^Ab)=I dxQAdxQB{^-(^AB)^T^{PAB\xQA,XQB){xoA,XQB\)- (3.25) 

The marginal distribution in phase-space is easily computed by integrating the cor- 
responding Wigner function in momentum space 



il{pAB\xoA-,XoB){xoA,XQB\) = / dPAd-PByVpAsiCAB) 



exp 



2cxXoAXoB-X{xl^+xlg ) 



(3.26) 



vry^ 



but the final expression of Eq. (|3.25|) has to be calculated numerically. Note that 
if Alice and Bob share as a resource M identical states (NPPT state for individual 
attacks, and NPPT fulfilling condition (|3.22|) for finite coherent attacks), the number 
of classically correlated bits that can be extracted from them is ~ M x £'(7^5). The 
efficiency Eq. (j3.25p increases with increasing D and decreasing gab- In particular, 
for the protocol given in [5], D = 0, and therefore E{'yAB) = for any state. 

We investigate now the dependence of E('yAB) with the entanglement of the 
NPPT mixed symmetric state used for the protocol as well as with the purity of the 
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Figure 3.1: Protocol efficiency (quantified by E^-jab)) versus the entanglement mea- 
sured by logarithmic negativity LN(7^b). The shading from black to white corre- 
sponds to purity from zero to one. 

state. As a measure of the entanglement between Alice and Bob we compute the 
logarithmic negativity 

LN(7^b) = log2 ( -==J=== I > 0. (3.27) 

In Fig. 13. H we display the efficiency of the protocol (assuming individual attacks) 
versus entanglement shared between Alice and Bob for different states jab- There 
is not a one-to-one correspondence between E{'yAB) and entanglement, since states 
with the same entanglement can have different purity, which can lead to different 
efficiency. This is so because there are two favourable scenarios to fulfil Eq. (|3.3p . 
The first one is to demand large correlations so that the relative error cab of Alice 
and Bob is small. The second scenario happens when Alice and Bob share a state 
with high purity, i.e., Eve is very disentangled. In this case, independently of the 
error €ab, Eq. (|3.3p can be fulfilled more easily. 

Despite the fact that efficiency generally increases with increasing entanglement, 
this enhancement, as depicted in the figure, is a complex function of the parame- 
ters involved. Nevertheless, one can see that there exist an entanglement threshold 
(around LN(7^b) ~ 0.2) below which the protocol efficiency diminishes drastically 
no matter how mixed are the states shared between Alice and Bob. 

It is also illustrative to examine the dependence of a (which determines the 
interval length D„) on the entanglement of the states shared by Alice and Bob. In 
Fig. 13.21 we plot the logarithmic negativity of a given state versus the parameter 
a. States with the same entanglement but different purity are associated to quite 
different values of a. Nevertheless states with high entanglement permit a large 
interval length (small a) and, thus, high efficiency. 
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Figure 3.2: Entanglement of the states shared between Alice and Bob measured in 
terms of the logarithmic negativity LN(7^b) as a function of the parameter 0(7^5) 
under individual attacks. The shading from black to white corresponds to purity 
from zero to one. 



In both, Fig. 13.11 and Fig. 13.21 we have observed that states with different 
entanglement give the same efficiency. However it is important to pointed out that 
to extract the key's bits, Classical Advantage Distillation [11] stills needs to be 
performed. The efficiency of Maurer's protocol, strongly increases with decreasing 
€AB, and, therefore, the states with higher entanglement will provide a higher key 
rate. 
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Summary and Conclusions 



Efficiency is a key issue for any experimental implementation of Quantum Cryptog- 
raphy since available resources are not unlimited. Here, we have shown that the 
sharing of entangled Gaussian variables and the use of only Gaussian operations 
permits efficient Quantum Key Distribution against individual and finite coherent 
attacks. 

We have used the fact that all mixed NPPT symmetric states can be used to 
extract secret bits under individual attacks whereas under finite coherent attacks an 
additional condition has to be fulfilled. We have introduced a figure of merit (the 
efficiency E) to quantify the number of classical correlated bits that can be used 
to distill a key from a sample of M entangled states. We have observed that this 
quantity grows with the entanglement shared between Alice and Bob. This relation 
it is not one-to-one due to the fact that states with less entanglement but with more 
purity (eavesdropper more disentangled) can be equally efficient. Nevertheless we 
have point out that, these states would be inefficient, when performing the Classical 
Advantage Distillation of the key. 

Finally, we would like to remark that our study is not restricted to Quantum 
Key Distribution protocols, but can be extended to any other protocol that uses as 
a resource entangled continuous variables to establish a set of classically correlated 
bits between distant parties, see e.g. [18] . 

In [TS] an efficient solution of the Byzantine Agreement problem (detectable 
broadcast) in the continuous variable scenario with multipartite entangled Gaussian 
states and Gaussian operations (homodyne detection) is presented. In a crypto- 
graphic context, detectable broadcast refers to distributed protocols in which some 
of the participants might have malicious intentions and could try to sabotage the dis- 
tributed protocol inducing the honest parties to take contradictory actions between 
them. Entanglement is used in the protocol to distribute classical private random 
variables with a specific correlation between the players, in such a way that any 
malicious manipulation of the data can be detected by all honest parties allowing 
them to abort the protocol. We discuss realistic implementations of the protocol, 
which consider the possibility of having inefficient homodyne detectors, not perfectly 
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correlated outcomes, and noise in the preparation of the resource states. The pro- 
posed protocol is proven to be robust and efficiently applicable under such non-ideal 
conditions. 

Following [19j, it is known that, in spite of their exceptional role within the space 
of all continuous variables states, in fact, Gaussian states are not the best candidates 
as resources to perform Quantum tasks. In general, any continuous, strongly, super- 
additive functional acting on any given covariance matrix is minimised by Gaussian 
states. This is the case for all entanglement measures fulfiling the above conditions 
e.g. the distillable entanglement or the entanglement of formation. In this sense 
Gaussian states are extremal. With this idea on mind, naturally one could try to 
perform QKD with non-Gaussian states. Following the presented protocol here one 
should expect an enhancement on the efficiency on the key distribution with non- 
Gaussian states. Gaussian states possess an easy mathematical description at the 
covariance matrix level while for non-Gaussian states this description is not complete. 
Nevertheless, the Wigner distribution function formalism presented here, allows to 
perform the needed calculations to study QKD with non-Gaussian states, in a very 
similar way. 

Also, for non-Gaussian states there are no computable entanglement measures 
while these are well established in the case of Gaussian states. Thus, one might think 
that a way to quantify entanglement in non-Gaussian states can be accomplished 
by relating the efficiency of distilling correlated bits with the entanglement of non- 
Gaussian states [20]. From the experimental point of view, there already exist several 
groups which actually have succeeded in producing non-Gaussian states like photon- 
substracted, states that up to now lack of a complete well caracterisation. 
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